Executive brief
NLTK is a popular Python library for natural language processing used to analyze and process text data. Versions before 3.10.3 contain a vulnerability that allows attackers who can place malicious symlinks within a trusted data directory to read sensitive files outside that directory. An attacker could exploit this to extract confidential information from the system by crafting corpus files that point to protected areas outside the intended data root.
Technical details
The vulnerability exists in NLTK's corpus readers (ipipan, crubadan, lin) which derive paths from trusted corpus state and reopen them using Python's built-in open() function instead of nltk.pathsec.open(). This bypasses NLTK's symlink-aware trusted-root security model. An attacker with ability to stage files or symlinks under a trusted NLTK data root can create symlinked corpus inputs (e.g., header.xml, table.txt, simN.lsp) that point outside the root directory. When the corpus reader processes these files through public methods like channels(), domains(), or synonyms(), the symlinks are followed, allowing information disclosure of files outside the intended trusted boundary. The fix involves replacing direct open() calls with nltk.pathsec.validate_path() and nltk.pathsec.open(), which respect the required_root boundary. Patched in version 3.10.3.
Affected products
- NLTK Project NLTK < 3.10.3
Timeline
- 2026-08-25: disclosed
- 2026-08-11: patched: Fix released in version 3.10.3